HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

7,500 Patients Notified of Indian Health Service PHI Theft

The medical records of approximately 7,500 patients of an Indian Health Service medical center have been recovered from storage units in Waterflow in New Mexico, at least 5 months after they were stolen by a former employee.

Back in October, the records of 470 patients of the Northern Navajo Medical Center in Shiprock were found in a public storage facility by a community member. The matter was reported to the Navajo Area Indian Health Service on October 5, 2015, and staff were sent to recover the documents.

According to the IHS breach notice, the Department of Health and Human Services Office of Inspector General Investigator investigated the breach and discovered that files had been taken by a former employee. Some of the employee’s personal items were also located in the storage facility.

The investigation revealed that the data breach was much more extensive than initially thought. A further 7,000 documents were also recovered from storage facilities and have now been returned to the medical center. Now that the files have been recovered, patients are being notified of the breach of their protected health Information (PHI). The delay in issuing breach notification letters to patients was at the request of law enforcement while the investigation into the theft was being conducted.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

The PHI contained in the files was highly sensitive and included the names of patients, their health insurance details, Social Security numbers, dates of birth, and medical diagnoses. Patients are now being provided with a year of credit monitoring and identity protection services via ID Experts, and will be protected with a $1,000,000 identity theft insurance policy.

Some months have passed since the files were taken, but Indian Health Service has not received any reports of data being used inappropriately.

To prevent similar data breaches from occurring in the future, Indian Health Service is conducting additional face to face training with staff members on document management responsibilities and further training is also being provided on laws covering the maintenance of government documents. Policies and procedures have also been updated to reduce the risk of further PHI breaches.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.